Migrate update_password_no_auth handler to v2 anonymous client

Replace the per-request v1 anonymous APISession in update_password_no_auth handler with the persistent v2 BackendAIAnonymousClient registered on the app.

Implementation:

- Replace the v1 block (APIConfig + APISession context manager + api_session.Auth.update_password_no_auth()) with app["anon_client"].update_password_no_auth() using UpdatePasswordNoAuthRequest DTO.

- Pass forwarding headers via build_forwarding_headers() + extra_headers parameter.

- Extract password_changed_at from the typed response.

- Add aiohttp.ClientError to the network error catch block, since the v2 client does not wrap aiohttp errors into BackendClientError.

This naturally fixes BA-1146 (400 "Malformed body") because the v2 client sends plain JSON instead of using v1's _put_secure_body() encryption.

Files:

- src/ai/backend/web/server.py

Depends on:

- BA-4837: Add extra_headers support to v2 BackendAIAnonymousClient

- BA-4838: Register persistent v2 anonymous client on webserver app

Story points: 1

JIRA Issue: BA-4839